twikoo-func 1.7.19 → 1.7.21

package/index.js

@@ -7,7 +7,7 @@
 const { version: VERSION } = require('./package.json')
 const tcb = require('@cloudbase/node-sdk') // 云开发 SDK
 const {
-  getCheerio,
+  getHtmlToText,
   getDomPurify,
   getMd5,
   getSha256,
@@ -63,7 +63,7 @@ const app = tcb.init({ env: tcb.SYMBOL_CURRENT_ENV })
 const auth = app.auth()
 const db = app.database()
 const _ = db.command
-const $ = getCheerio()
+const htmlToText = getHtmlToText()
 const DOMPurify = getDomPurify()
 const md5 = getMd5()
 const sha256 = getSha256()
@@ -1026,7 +1026,7 @@ async function getRecentComments (event) {
         mailMd5: getMailMd5(comment),
         link: comment.link,
         comment: comment.comment,
-        commentText: $(comment.comment).text(),
+        commentText: htmlToText(comment.comment),
         created: comment.created
       }
     })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "twikoo-func",
-  "version": "1.7.19",
+  "version": "1.7.21",
   "description": "A simple comment system.",
   "author": "imaegoo <hello@imaegoo.com> (https://github.com/imaegoo)",
   "license": "MIT",
@@ -15,22 +15,19 @@
     "@xsai/shared": "0.2.2",
     "@xsai/shared-chat": "0.2.2",
     "@cap.js/server": "^4.0.5",
-    "@cloudbase/manager-node": "^3.9.0",
     "@cloudbase/node-sdk": "^2.5.0",
     "@imaegoo/node-ip2region": "^2.1.1",
     "akismet-api": "^5.1.0",
     "axios": "^1.6.2",
-    "blueimp-md5": "^2.18.0",
     "bowser": "^2.11.0",
-    "cheerio": "1.0.0-rc.5",
-    "crypto-js": "^4.0.0",
-    "dompurify": "^2.5.9",
+    "dompurify": "^3.4.14",
     "form-data": "^4.0.0",
-    "jsdom": "^16.4.0",
+    "html-to-text": "^9.0.5",
+    "jsdom": "^22.1.0",
     "marked": "^4.0.12",
     "nodemailer": "^9.0.5",
     "pushoo": "latest",
-    "tencentcloud-sdk-nodejs": "^4.0.65",
+    "tencentcloud-sdk-nodejs-tms": "^4.1.293",
     "xml2js": "^0.6.0"
   }
 }

package/utils/index.js

@@ -99,7 +99,7 @@ const fn = {
       ruser: fn.ruser(comment.pid, comments),
       top: comment.top,
       isSpam: comment.isSpam,
-      isOwner: comment.uid === uid,
+      isOwner: Boolean(uid && comment.uid === uid),
       created: comment.created,
       updated: comment.updated
     }
@@ -474,7 +474,9 @@ const fn = {
     if (!comment) {
       throw new Error('评论不存在')
     }
-    if (comment.uid !== uid) {
+    // 无 token 的请求不具备任何归属权，必须直接拒绝，
+    // 防止 comment.uid 与 uid 同时为 undefined 时误判为本人
+    if (!uid || comment.uid !== uid) {
       throw new Error('只能删除自己的评论')
     }
     return comment

package/utils/lib.js

@@ -1,21 +1,25 @@
+const crypto = require('crypto')
+
 let customLibs = {}
 
 module.exports = {
   setCustomLibs (libs) {
     customLibs = libs
   },
-  getCheerio () {
-    const $ = require('cheerio') // jQuery 服务器版
-    return $
+  getHtmlToText () {
+    const { compile } = require('html-to-text') // HTML 转纯文本
+    return compile({
+      wordwrap: false,
+      selectors: [
+        { selector: 'a', options: { ignoreHref: true } },
+        { selector: 'img', format: 'skip' }
+      ]
+    })
   },
   getAkismetClient () {
     const { AkismetClient } = require('akismet-api') // 反垃圾 API
     return AkismetClient
   },
-  getCryptoJS () {
-    const CryptoJS = require('crypto-js') // 编解码
-    return CryptoJS
-  },
   getFormData () {
     const FormData = require('form-data') // 图片上传
     return FormData
@@ -46,13 +50,13 @@ module.exports = {
     return marked
   },
   getMd5 () {
-    const md5 = require('blueimp-md5') // MD5 哈希
-    return md5
+    return (message) => {
+      return crypto.createHash('md5').update(String(message)).digest('hex')
+    }
   },
   getSha256 () {
-    const { SHA256 } = require('crypto-js') // SHA256 哈希
     return (message) => {
-      return SHA256(message).toString()
+      return crypto.createHash('sha256').update(message == null ? '' : String(message)).digest('hex')
     }
   },
   getNodemailer () {
@@ -64,9 +68,9 @@ module.exports = {
     const pushoo = require('pushoo').default // 即时消息通知
     return pushoo
   },
-  getTencentcloud () {
-    const tencentcloud = require('tencentcloud-sdk-nodejs') // 腾讯云 API NODEJS SDK
-    return tencentcloud
+  getTencentcloudTms () {
+    const tencentcloudTms = require('tencentcloud-sdk-nodejs-tms') // 腾讯云文本内容安全 SDK
+    return tencentcloudTms
   },
   getXml2js () {
     const xml2js = require('xml2js') // XML 解析

package/utils/notify.js

@@ -1,10 +1,10 @@
 const { equalsMail, getAvatar, isValidEmail } = require('.')
 const {
-  getCheerio,
+  getHtmlToText,
   getNodemailer,
   getPushoo
 } = require('./lib')
-const $ = getCheerio()
+const htmlToText = getHtmlToText()
 const pushoo = getPushoo()
 const { RES_CODE } = require('./constants')
 const logger = require('./logger')
@@ -175,7 +175,7 @@ const fn = {
     const NICK = escapeHtml(comment.nick)
     const MAIL = escapeHtml(comment.mail)
     const IP = comment.ip
-    const COMMENT = $(comment.comment).text()
+    const COMMENT = htmlToText(comment.comment)
     const SITE_URL = config.SITE_URL
     const POST_URL = escapeHtml(fn.appendHashToUrl(comment.href || SITE_URL + comment.url, comment.id))
     const subject = config.MAIL_SUBJECT_ADMIN || `${SITE_NAME}有新评论了`

package/utils/spam.js

@@ -1,28 +1,26 @@
 const {
   getAkismetClient,
-  getCryptoJS,
-  getTencentcloud
+  getTencentcloudTms
 } = require('./lib')
 const {
   equalsMail
 } = require('.')
 const AkismetClient = getAkismetClient()
-const CryptoJS = getCryptoJS()
 
 const logger = require('./logger')
 
-let tencentcloud
+let tencentcloudTms
 let generateTextPromise
 
-function getTencentCloud () {
-  if (!tencentcloud) {
+function getTencentCloudTms () {
+  if (!tencentcloudTms) {
     try {
-      tencentcloud = getTencentcloud() // 腾讯云 API NODEJS SDK
+      tencentcloudTms = getTencentcloudTms()
     } catch (e) {
-      logger.warn('加载 "tencentcloud-sdk-nodejs" 失败', e)
+      logger.warn('加载 "tencentcloud-sdk-nodejs-tms" 失败', e)
     }
   }
-  return tencentcloud
+  return tencentcloudTms
 }
 
 function getGenerateText () {
@@ -185,14 +183,14 @@ const fn = {
         isSpam = false
       } else if (config.QCLOUD_SECRET_ID && config.QCLOUD_SECRET_KEY) {
         // 腾讯云内容安全
-        const client = new (getTencentCloud().tms.v20201229.Client)({
+        const client = new (getTencentCloudTms().tms.v20201229.Client)({
           credential: { secretId: config.QCLOUD_SECRET_ID, secretKey: config.QCLOUD_SECRET_KEY },
           region: 'ap-shanghai',
           profile: { httpProfile: { endpoint: 'tms.tencentcloudapi.com' } }
         })
         const textModerationParams = {
           // 文档: https://cloud.tencent.com/document/api/1124/51860
-          Content: CryptoJS.enc.Base64.stringify(CryptoJS.enc.Utf8.parse(comment.comment)),
+          Content: Buffer.from(comment.comment, 'utf8').toString('base64'),
           DataId: comment.id,
           User: { Nickname: comment.nick },
           Device: { IP: comment.ip }
@@ -204,6 +202,9 @@ const fn = {
         const checkResult = await client.TextModeration(textModerationParams)
         logger.log('腾讯云返回结果：', checkResult)
         isSpam = checkResult.Suggestion !== 'Pass'
+        if (isSpam) {
+          logger.warn(`腾讯云判定不通过: id="${comment.id}" nick="${comment.nick}" suggestion="${checkResult.Suggestion}" label="${checkResult.Label}" subLabel="${checkResult.SubLabel}"`)
+        }
       } else if (config.AKISMET_KEY) {
         // Akismet
         const akismetClient = new AkismetClient({